CLAIMS 



1. 



A method for rolling back an image comprising: 
determining a roll-back state; 
configuring a current state to the roll-back state; and 
determining whether the roll-back state is secure. 



5 



2. 



A method as recited in claim 1 further including securing the roll-back state. 



3. 



A method as recited in claim 1 wherein the image is a system. 



10 



4. A method as recited in claim 1 wherein the image is a file. 

5. A method as recited in claim 1 wherein the image is an application. 

15 6. A method as recited in claim 1 wherein determining a roll-back state includes 
determining a non-infected state. 

7. A method as recited in claim 1 wherein configuring a current state to the roll-back 
state includes marking a first portion of a repository. 



8. A method as recited in claim 7 wherein configuring a current state to the roll-back 
state further includes reverting a second portion of the repository. 

9. A method as recited in claim 1 wherein securing the roll-back state further 
25 includes evaluating a definition in a repository providing data to the roll-back state. 

10. A method as recited in claim 1 wherein securing the roll-back state further 
includes determining whether the definition is updated. 
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11. A method as recited in claim 1 wherein securing the roll-back state further 
includes retrieving an updated definition if the definition is not updated. 

12. A method as recited in claim 1 wherein securing the roll-back state further 
5 includes installing the updated definition if the definition is not updated. 

13. A method as recited in claim 1 wherein configuring a current state to the roll-back 
state further includes: 

displaying a message; and 
1 0 receiving a user input. 

14. A method as recited in claim 13 wherein configuring a current state to the roll- 
back state further includes using the user input to determine the roll-back state. 

15 15. A method for rolling back a computer state comprising: 
scanning a repository; 

leaving a marker in a first portion of the repository; 
determining a safe state; 

reverting the computer state to the safe state; and 
20 analyzing a second portion of the repository determined by the marker and the 

safe state. 

16. A method as recited in claim 15 wherein scanning the repository further 
comprises: 

25 determining a version; and 

updating the version if the version occurred prior to leaving the marker in the first 
portion of the repository. 

17. A method as recited in claim 15 wherein determining a safe state includes 
30 searching for a virus. 
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18. A method as recited in claim 15 wherein determining a safe state includes 
evaluating a result of a vulnerability assessment. 

19. A method as recited in claim 15 wherein reverting the computer state to a safe 
state includes restoring a system to a previously non-infected version of the system. 

20. A method as recited in claim 1 5 wherein reverting the computer state to a safe 
state includes restoring a file to a previously non-infected version of the file. 

21. A method as recited in claim 1 5 wherein reverting the computer state to a safe 
state includes restoring an application to a previously non-infected version of the 
application. 

22. A method as recited in claim 1 5 wherein the first portion of the repository is non- 
revertible. 

23. A method as recited in claim 1 5 wherein the second portion of the repository is 
revertible. 

24. A system for rolling back an image comprising: 
a repository for storing data; 

a scanner for determining a roll-back state; 

a protection module for configuring a current state to the roll-back state; and 
a definition for securing the roll-back state. 

25. A system as recited in claim 24 wherein the repository further includes: 
a first portion of non-revertible memory for storing a marker; and 

a second portion of revertible memory for storing data related to the roll-back 

state. 



Attorney Docket No. SYMAP024 



20 



PATENT 



26. A computer program product for rolling back an image, the computer program 
product being embodied in a computer readable medium and comprising computer 
instructions for: 

5 determining a roll-back state; 

configuring a current state to the roll-back state; and 
securing the roll-back state. 

27. A computer program product for rolling back a computer state, the computer 
10 program product being embodied in a computer readable medium and comprising 

computer instructions for: 

scanning a repository; 

leaving a marker in a first portion of the repository; 
15 determining a safe state; 

reverting the computer state to the safe state; and 

analyzing a second portion of the repository determined by the marker and the 
safe state. 

20 28. A data signal embodied in a carrier wave comprising: 
instructions for determining a roll-back state; 
instructions for configuring a current state to the roll-back state; and 
instructions for securing the roll-back state. 

25 29. A data signal embodied in a carrier wave comprising: 
instructions for scanning a repository; 

instructions for leaving a marker in a first portion of the repository; 
instructions for determining a safe state; 

instructions for reverting the computer state to the safe state; and 
30 instructions for analyzing a second portion of the repository determined by the 

marker and the safe state. 
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